Add the licence policy, and enforce permissive-only dependencies

Continuum is intended to be sold, so every dependency has to permit
distribution in closed-source commercial software. Nothing recorded that
before: our own crates and npm packages carried no licence field at all,
which made `cargo deny` report them as `unlicensed` errors and left the
actual policy nowhere.

docs/LICENSES.md is the policy and lives here because it is the repo both
other tiers already depend on. It covers the allow/deny list, the
2026-09-17 audit of all six repos (no copyleft reaches any binary), and
the three categories `cargo deny` structurally cannot see: external
binaries we spawn or ship, ML model weights, and self-hosted server
software whose licence is not its client library's.

Two findings in there are worth more than the tooling: Redis 7.4+ is
RSALv2/SSPL and 8.0+ adds AGPLv3, and Ultralytics YOLO and Obico's
print-failure model are both AGPL-3.0 - the obvious choice in each case
is the one we cannot ship.

Crates declare `LicenseRef-Proprietary` with `publish = false`; that
string is deliberately not valid SPDX so it must never enter an allow
list. npm packages use `"license": "UNLICENSED"`.

This commit is contained in:

octoturge

2026-10-03 10:10:08 +00:00

parent fed19b260f

commit d5375254d7

6 changed files with 196 additions and 0 deletions

									
										packages/ts-core/package.json
									
		+1
		
												View File
												
				@@ -1,5 +1,6 @@

				{

				  "name": "@continuum/ts-core",

				  "license": "UNLICENSED",

				  "version": "0.1.0",

				  "private": true,

				  "type": "module",